Friend's Computer - Big Mess

Discussion in 'Malware Help (A Specialist Will Reply)' started by chadtlower, Apr 5, 2014.

  1. chadtlower

    chadtlower Private E-2

    My friend was pretty sure her computer had a virus, so brought it to me to take a look at. I tried downloading the programs suggested, but kept getting an error that I did not have permission to download them. I even tried to boot to safemode with networking, but that didn't work either. I ended up using Windows Offline Defender to clear some trojans, but then her computer wouldn't boot properly. It reminded me of the description in a thread older than this one. (I had posted the link, but I think it sent my message to the SPAM folder.)

    Eventually, I had it restore from the backup on the hard drive partition. It moved all her files in the My Documents to a new folder and reinstalled Windows. I moved those documents back and installed the software that we could find to try to restore her computer. I also installed SpeedFan so she could monitor her temp (it kept shutting off from overheating - her fins were bent, so I straightened them back out which helped but it still runs hot). And I installed Secunia PSI so that it would mostly keep her up to date with minimal effort on her part.

    When I boot the computer, sometimes they will run at startup and other times not. I have MSE installed and sometimes that will start at boot and sometimes not. I am guessing there may have been stuff in her My Documents folder that I reintroduced. When restoring Windows 7, it did give a disclaimer that if there was a virus or other malware, it may not be removed properly by reinstalling Windows. Not sure what other information you might need.
     

    Attached Files:

  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Other than what MBAM found, I am not seeing any malware.

    Download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop.
    • Now run Repair_Windows.exe by double clicking on it ( if you are running Vista or Win 7, use right click and select Run As Administrator)
    • Now select the Start Repairs tab.
    • The click the Start button.
    • Create a System Restore point if prompted.
    • On the next screen, click the Unselect All button to first deselect all repairs.
    • Now select the following repair options:
      • Reset Registry Permissions
      • Reset File Permissions
      • Register System Files
      • Repair WMI
      • Repair Windows Firewall
      • Remove Policies Set By Infections
      • Repair Winsock & DNS Cache
      • Repair Proxy Settings
      • Repair Windows Updates
      • Set Windows Services To Default Startup
    • Now on the lower right side check the box to Restart/Shutdown System When Finished
    • Then make sure the Restart System radio button is enabled.
    • Shutdown any other programs that you are running now before continuing.
    • Now click the Start button.
    • Be patient while the tool repairs the selected items.
    • It should reboot automatically when finished.
     
  3. chadtlower

    chadtlower Private E-2

    TimW,

    Thank you for the quick response. Ran as requested and attached the log. There were many, so I just zipped them together for easier upload. The computer was incredibly slow to respond after rebooting. I am hoping it was just a one-time deal after repairing all those items. Seems to be back up to speed now.

    I did notice that AutoRunEater did not auto-start this time when the computer rebooted. I don't know if I will need to reinstall that after doing the repair.

    Also, I forgot to mention that after reinstalling Win 7, I was able to download and install Windows updates *except* SP 1. I thought of it after seeing your request to Repair Windows Updates. After I post this, I am going to see if I and get that to take.

    Please let me know if there is anything else you need. Thank you again.
     

    Attached Files:

  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Let me know what is happening.
     
  5. chadtlower

    chadtlower Private E-2

    It downloads okay and gives me a message that the update finished installing successfully. Then I am asked to reboot the computer to finish installing updates (there is only the one). When I reboot, it comes to a page that says Configuring Pack and gets up to 8% complete, then stalls for a long time, eventually rebooting without updating.

    Currently, it is still at 8%. Hasn't rebooted yet, but from past experience, it probably will eventually.
     
  6. chadtlower

    chadtlower Private E-2

    As a follow-up to the last message, it did get to 9%. I usually start it and then go to bed or go to work, so I have never seen it go to 9% before, but have no reason to think that it did not.

    After rebooting, it rebooted again on its own (I was on a different computer in the same room). After the second time, I received a message that I have not seen before. (Again, it may have been there, but I wasn't around to see it.)

    It read:
    Installation not successful.
    The function attempted to use a name that is reserved for use by another transaction.

    When I click on Details, it reads:
    Error: ERROR_TRANSACTIONAL_CONFLICT(0x80071a90)

    It also had a link to, "Go online to learn more about this issue." The link took me to a Microsoft page titled, "Troubleshoot problems installing a service pack for Windows 7 or Windows Server 2008 R2." There are three suggestions to try. The first is to "Run the System Update Readiness Tool," which appears to be almost 450 MB in size. On my slow DSL connection, it is predicting another 2 hrs 30 min to finish downloading.
     
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Since this is not a malware issue, I suggest you post in the software forum for further assistance.

    Since you are not having any malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    2. Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.
    3. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    4. If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    6. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds